kosa8 docs

Commands / kosa8 key

kosa8 key

Manage the keys that encrypt snapshots at rest and in transit

Each encrypted snapshot has its own data key, stored only wrapped under a key-encryption key (KEK). The KEK is held by a provider: today a file in ~/.kosa8/keys, protected by its permissions and by FileVault or LUKS (KOSA8_KEY_PROVIDER=file). Keychain, TPM, PKCS#11 and cloud KMS providers are planned behind the same interface.

See docs/design/encryption-at-rest.md.

Subcommands

kosa8 key exportWrite the active KEK to a file, to import on another machine kosa8 key importAdd a KEK exported from another machine and make it active kosa8 key rotateRewrap every snapshot key under a new KEK and destroy the old one kosa8 key statusShow the key provider, the KEKs held, and how many snapshot keys they wrap